MONTANA CONSUMER DATA PRIVACY ACT (MCDPA) PRIVACY NOTICE

Effective Date: [DATE]
Last Updated: [DATE]

NOTICE TO MONTANA RESIDENTS

This Privacy Notice is provided pursuant to the Montana Consumer Data Privacy Act, codified at Montana Code Annotated (MCA) Section 30-14-2801 et seq., which became effective October 1, 2024, with amendments via SB 297 effective October 1, 2025.

1. SCOPE AND APPLICABILITY

1.1 Who This Notice Applies To

This Notice applies to Montana residents acting in an individual or household context ("consumers"). It does not apply to individuals acting in a commercial or employment context.

1.2 Applicability Thresholds

Original Thresholds (Pre-October 1, 2025):

☐ Controls or processes personal data of at least 50,000 Montana consumers

☐ Controls or processes personal data of at least 25,000 Montana consumers AND derives more than 25% of gross revenue from the sale of personal data

Revised Thresholds (SB 297 - Effective October 1, 2025):

☐ Controls or processes personal data of at least 25,000 Montana consumers (reduced from 50,000)

☐ Controls or processes personal data of at least 15,000 Montana consumers (reduced from 25,000) AND derives more than 25% of gross revenue from the sale of personal data

1.3 Exemptions

Pursuant to MCA Section 30-14-2803, the following are exempt:

• State and local government entities
• Nonprofit organizations
• Higher education institutions
• Covered entities and business associates under HIPAA
• Data regulated by specific federal laws (GLBA, HIPAA, FCRA, FERPA, COPPA, DPPA, Farm Credit Act)
• Air carriers

Note (SB 297): The Gramm-Leach-Bliley Act entity exemption was removed, but data-level exemption remains. Banks, credit unions, insurers, and insurance producers are now specifically exempted.

2. DEFINITIONS

Pursuant to MCA Section 30-14-2803:

"Personal Data" means any information that is linked or reasonably linkable to an identified or identifiable individual, excluding de-identified data and publicly available information.

"Sensitive Data" includes personal data revealing:
- Racial or ethnic origin
- Religious beliefs
- Mental or physical health diagnosis
- Sexual orientation
- Citizenship or immigration status
- Genetic or biometric data for identification purposes
- Personal data collected from a known child
- Precise geolocation data

"Sale" means the exchange of personal data for monetary consideration.

"Targeted Advertising" means displaying advertisements based on personal data obtained from consumer's activities over time and across nonaffiliated websites or applications.

"Profiling" means any form of automated processing to evaluate, analyze, or predict aspects concerning a natural person.

3. CATEGORIES OF PERSONAL DATA PROCESSED

Pursuant to MCA Section 30-14-2811(1)(a), we process the following categories of personal data:

3.1 General Personal Data

3.2 Sensitive Data

Pursuant to MCA Section 30-14-2811(4), we collect sensitive data only with your consent:

4. PURPOSES OF PROCESSING

Pursuant to MCA Section 30-14-2811(1)(a)(ii), we process personal data for:

☐ Providing and maintaining our services

☐ Processing transactions and orders

☐ Communicating with you about your account

☐ Customer support and inquiries

☐ Security and fraud prevention

☐ Legal compliance

☐ Research and analytics

☐ Marketing and promotional communications

☐ Personalization of services

☐ Targeted advertising (subject to opt-out)

☐ [ADDITIONAL PURPOSES]

5. SALE OF PERSONAL DATA AND TARGETED ADVERTISING

5.1 Sale of Personal Data

Pursuant to MCA Section 30-14-2805(1)(d):

☐ We sell personal data

☐ We do not sell personal data

Categories of Data Sold:

5.2 Targeted Advertising

Pursuant to MCA Section 30-14-2805(1)(c):

☐ We process personal data for targeted advertising

☐ We do not process personal data for targeted advertising

5.3 Profiling

Pursuant to MCA Section 30-14-2805(1)(e):

☐ We engage in profiling that produces legal or similarly significant effects

☐ We do not engage in such profiling

6. THIRD-PARTY DISCLOSURES

Pursuant to MCA Section 30-14-2811(1)(a)(iii-iv), we share personal data with:

7. YOUR MONTANA PRIVACY RIGHTS

Pursuant to MCA Section 30-14-2805, Montana consumers have the following rights:

7.1 Right to Know/Access (Section 30-14-2805(1)(a))

You have the right to confirm whether we are processing your personal data and to access such data.

7.2 Right to Correct (Section 30-14-2805(1)(b))

You have the right to correct inaccuracies in your personal data.

7.3 Right to Delete (Section 30-14-2805(1)(f))

You have the right to delete personal data provided by or obtained about you.

7.4 Right to Data Portability (Section 30-14-2805(1)(g))

You have the right to obtain a copy of your personal data in a portable and, to the extent technically feasible, readily usable format.

7.5 Right to Opt Out (Section 30-14-2805(1)(c-e))

You have the right to opt out of:
- Targeted advertising
- Sale of personal data
- Profiling in furtherance of decisions that produce legal or similarly significant effects

8. EXERCISING YOUR RIGHTS

8.1 How to Submit a Request

Methods to Submit Requests:

☐ Online Portal: [URL]

☐ Email: [PRIVACY EMAIL]

☐ Phone: [PHONE NUMBER]

☐ Mail: [MAILING ADDRESS]

8.2 Identity Verification

We will authenticate your identity before fulfilling your request using commercially reasonable methods.

8.3 Authorized Agents

You may designate an authorized agent to submit requests on your behalf. We may require:

• Written authorization signed by you
• Verification of your identity
• Verification of the agent's authority

8.4 Response Timeline

Pursuant to MCA Section 30-14-2805(2)(c):

• Initial Response: Within 45 days of receipt
• Extension: May extend by an additional 45 days when reasonably necessary
• Notification: We will inform you of any extension and the reason

8.5 No Fee

We provide responses free of charge. We may charge a reasonable fee for manifestly unfounded, excessive, or repetitive requests.

9. UNIVERSAL OPT-OUT MECHANISMS (EFFECTIVE JANUARY 1, 2025)

9.1 Recognition of Opt-Out Preference Signals

Pursuant to MCA Section 30-14-2805, effective January 1, 2025, we recognize and process universal opt-out mechanisms including:

☐ Global Privacy Control (GPC)

☐ Other Universal Opt-Out Mechanisms: [SPECIFY]

9.2 How Universal Opt-Out Requests Are Processed

When we receive a universal opt-out signal, we will:

• Process it as a valid opt-out request for targeted advertising and sale of personal data
• Apply the opt-out to the browser or device from which the signal was sent
• Not require you to verify your identity for opt-out requests

9.3 Opt-Out Link

"Your Privacy Choices" Link: [URL]

10. RIGHT TO APPEAL

10.1 Appeal Process

Pursuant to MCA Section 30-14-2805(2)(d), if we decline your request, you have the right to appeal.

To Submit an Appeal:

☐ Email: [APPEAL EMAIL]

☐ Online Form: [URL]

☐ Mail: [ADDRESS]

10.2 Appeal Response

• We will respond to your appeal within 60 days
• If we deny your appeal, we will provide a method to contact the Montana Attorney General

10.3 Contact the Attorney General

Montana Department of Justice
Office of Consumer Protection
P.O. Box 200151
Helena, MT 59620-0151
Phone: (406) 444-4500
Website: dojmt.gov/office-of-consumer-protection

11. CURE PERIOD

11.1 Before April 1, 2026

Pursuant to MCA Section 30-14-2817, we may receive a 60-day notice and opportunity to cure alleged violations.

11.2 After April 1, 2026

The mandatory 60-day cure period expires April 1, 2026. After this date, no cure period is required.

12. MINOR PROTECTIONS (SB 297)

12.1 Duty of Reasonable Care for Minors

Pursuant to SB 297, if we offer online services, products, or features to users we actually know or willfully disregard are minors:

☐ We exercise a duty of reasonable care to avoid heightened risk of harm to minors

☐ We implement age-appropriate design features

12.2 Definition of Minor

A "minor" means an individual under 18 years of age.

12.3 Children Under 13

We comply with COPPA and obtain verifiable parental consent before collecting personal data from children under 13.

13. DATA PROTECTION ASSESSMENTS

Pursuant to MCA Section 30-14-2815, we conduct data protection assessments for processing activities that present heightened risk of harm, including:

☐ Processing for targeted advertising

☐ Sale of personal data

☐ Processing for profiling with reasonably foreseeable risk

☐ Processing sensitive data

☐ Any processing presenting heightened risk of harm

Note: Data protection assessment obligations apply to activities created or generated after January 1, 2025, and are not retroactive.

14. DATA MINIMIZATION AND PURPOSE LIMITATION

14.1 Data Minimization

Pursuant to MCA Section 30-14-2811(2), we limit collection to what is adequate, relevant, and reasonably necessary for the specified purposes.

14.2 Purpose Limitation

Pursuant to MCA Section 30-14-2811(3), we do not process personal data for purposes incompatible with the disclosed purposes without obtaining your consent.

15. DATA SECURITY

Pursuant to MCA Section 30-14-2811(1)(b), we maintain reasonable administrative, technical, and physical data security practices to protect:

• The confidentiality and integrity of personal data
• Against unauthorized access, use, or disclosure

Our security measures include:

☐ Encryption of data in transit and at rest

☐ Access controls and authentication

☐ Regular security assessments

☐ Employee training

☐ Incident response procedures

☐ Vendor security requirements

16. DATA RETENTION

We retain personal data only as long as reasonably necessary for the purposes disclosed:

17. CONTROLLER AND PROCESSOR RELATIONSHIPS

17.1 Controller Information

[COMPANY NAME] is the controller of personal data processed under this Notice.

Controller Contact:
[ADDRESS]
[EMAIL]
[PHONE]

17.2 Processor Contracts

Pursuant to MCA Section 30-14-2813, our contracts with processors include:

• Clear processing instructions
• Nature and purpose of processing
• Type of data processed
• Duration of processing
• Rights and obligations of both parties
• Confidentiality requirements
• Subprocessor restrictions
• Audit rights

18. ENFORCEMENT

18.1 Attorney General Enforcement

The Montana Attorney General has exclusive enforcement authority.

18.2 No Private Right of Action

The MCDPA does not create a private right of action for consumers.

19. CONTACT INFORMATION

Privacy Inquiries:

Name: [PRIVACY OFFICER NAME]
Title: [TITLE]
Email: [EMAIL]
Phone: [PHONE]
Address: [ADDRESS]

Consumer Rights Requests:

Email: [EMAIL]
Online: [URL]
Phone: [PHONE]

20. CHANGES TO THIS NOTICE

We may update this Notice to reflect changes in our practices or legal requirements. We will notify you of material changes:

☐ By posting an updated Notice on our website

☐ By email notification

☐ By notice within our application

DOCUMENT CONTROL

Legal Review: ☐ Completed Date: _________ Reviewer: _________

Next Review Date: _____________

This Notice is provided for informational purposes and compliance with the Montana Consumer Data Privacy Act. It does not constitute legal advice. Consult with qualified legal counsel for specific compliance questions.